fte

Submitted by kazamiya on Sat, 01/24/2015 - 23:02

fte(FILETIME Extractor) gets accurate timestamps and several information on NTFS.

fte 1.8

    Feature

    • calculates accurate timestamp value in accordance with provided resolution.
    • estimates original data type based on combination of timestamps value.
    • parses NTFS internal file like $MFT file, $ObjID file, $INDX_ALLOCATION attribute.
    • gets timestamp of $FILE_NAME attribute in NTFS.
    • shows timestamps with maximal accuracy on network share.

    Download

    fte_1.8.2.zip (MD5: 7fb35b5e1d6b72304b62fa4dacd6962c)
    fte_1.8.1.zip (MD5: bc815fbb87d8b4ced19a5e6603493916)
    fte_1.8.zip (MD5: e4688bdc1ed244224619354760f688fb)

    Document

    Refer to the links.

    License

    You may use the SOFTWARE freely for personal or commercial and NO WARRANTIES.

    History

    2015/01/24

    Version 1.8.2 released.

    • Parsing MFT FILE record as file (File > Open > MFT)
    • Parsing INDX record as fil (File > Open > INDX)
    • Enhancement of Error handling for FILE record
    • Unlock available memory limit to migrate out of memory

    2012/09/02

    Version 1.8.1 released. Implemented strict condition for estimation of INDX record.

    changed from 1.7 are:

    • Added support for parsing $ObjID
    • Added support for parsing $INDEX_ALLOCATION attribute(INDX tab)
    • Added type column for detection of timestamp style(MFT/INDX tab)

    2012/08/09

    Addition to parse INDX record (1.8)

    2012/07/02

    Addition to parse ObjID (1.7)

    2011/07/10

    Addition to parse NTFS (1.6)

    2011/05/15

    Fix bugs, change layout, drag&drop compatibility (1.5.1)

    2011/05/10

    First GUI version (1.5)